Planning and risk assessment

Welcome to the Roadmap of Auditing!

Hello there! Welcome to one of the most critical chapters in your HKICPA QP journey: Planning and Risk Assessment. If you’ve ever tried to build a complex Lego set without the instruction manual, you know how messy things can get. In auditing, Planning is our instruction manual. It ensures we spend our time on the things that actually matter, rather than getting lost in the "small stuff."

Don't worry if this seems a bit technical at first. We are going to break it down into simple, bite-sized pieces. Think of this chapter as learning how to be a professional "detective" – before we go out and look for clues, we need a solid plan!

1. Why do we bother Planning? (HKSA 300)

Planning isn't just a box-ticking exercise; it’s required by HKSA 300 Planning an Audit of Financial Statements. The main goal is to conduct the audit effectively and efficiently.

The Benefits of Planning:

• Focus: It helps us pay attention to the most important areas of the business (the "high-risk" areas).
• Problem Solving: It helps us identify potential problems early so they don't surprise us later.
• Organization: It ensures the right team members (with the right skills) are assigned to the right tasks.
• Coordination: It helps us coordinate work done by other auditors or experts.

Did you know? Planning is not a discrete phase that ends before the "real work" begins. It is a continuous and iterative process. As we learn more about the client during the audit, we often have to go back and update our plan!

Summary Takeaway: Good planning saves time, reduces the risk of missing a big mistake, and keeps the audit team organized.

2. Strategy vs. Plan: What’s the Difference?

Students often get these two mixed up. Here is a simple way to remember them:

A. The Overall Audit Strategy

This is the "Big Picture." It sets the scope, timing, and direction of the audit. It answers questions like: How big is the client? When is the deadline? Which locations do we need to visit?

B. The Audit Plan

This is the "Nitty-Gritty." It is more detailed than the strategy. It describes the Nature, Timing, and Extent (NTE) of the specific procedures we will perform.

Analogy: Imagine you are planning a holiday. The Strategy is deciding you want to go to Japan for two weeks in December to see the snow. The Audit Plan is the daily itinerary listing exactly which trains you’ll take and which sushi restaurants you’ll visit.

Quick Review Box:
Strategy = Big Picture (Scope/Direction).
Plan = Detailed Instructions (Step-by-step procedures).

3. Understanding the Entity (HKSA 315)

To find where things might be wrong, you first have to know how they should look. Under HKSA 315, auditors must understand the client’s environment. You should look at:

• External Factors: Industry trends, laws, and the economic climate (e.g., is the retail industry struggling?).
• Nature of the Entity: What do they sell? Who owns them? How do they make money?
• Accounting Policies: Are they using the correct HKFRS standards?
• Internal Controls: Does the company have its own "safety nets" to prevent errors?

Common Mistake to Avoid: Don't just look at the numbers! Understanding the business model is just as important as looking at the balance sheet. If a company sells high-tech gadgets that go out of style quickly, there is a high risk that their "Inventory" value is overstated.

4. The Audit Risk Model

This is the "heart" of risk assessment. The goal of an audit is to reduce Audit Risk to an acceptably low level.

The formula looks like this:

\( Audit\ Risk = Inherent\ Risk \times Control\ Risk \times Detection\ Risk \)

Breaking down the components:

1. Inherent Risk (IR): The risk that a mistake happens just because of the nature of the business or the account, before considering any controls. (Example: Estimating the value of a complex lawsuit is naturally risky/difficult).

2. Control Risk (CR): The risk that the company’s own internal "safety nets" fail to catch the mistake.

Note: IR and CR together are called the Risk of Material Misstatement (RoMM). The auditor cannot change these; they belong to the client!

3. Detection Risk (DR): The risk that we (the auditors) fail to find the mistake with our testing. This is the only part of the equation we can control.

The Inverse Relationship:
If the client’s risk (IR and CR) is HIGH, we must make our Detection Risk LOW. To make DR low, we have to do MORE work (more testing, larger samples).
High Client Risk = More Audit Work.

Summary Takeaway: We assess the client's risk so we can decide how much work we need to do to feel confident in our opinion.

5. Materiality (HKSA 320)

In auditing, we don't look for every single cent. We look for Material amounts. Materiality is the "Who Cares?" threshold. If an error is big enough to change the decision of someone reading the financial statements, it is material.

Types of Materiality:

• Overall Materiality: Based on the financial statements as a whole. (Commonly 5% of Profit Before Tax or 1% of Total Assets).
• Performance Materiality: A slightly lower "buffer" amount we use to reduce the risk that the total of several small uncorrected errors exceeds overall materiality.
• Specific Materiality: Used for sensitive areas like Director’s Remuneration where even a small mistake matters.

Mnemonic for Benchmarks:
Profit = 5%
Revenue = 0.5% - 1%
Assets = 1% - 2%
(Think: P.R.A.)

6. Analytical Procedures in Planning

At the planning stage, we use Analytical Procedures to spot "red flags." We compare the current year's numbers to last year, or to our expectations.

Step-by-Step Process:
1. Compare: Look at this year vs. last year (Variance Analysis).
2. Calculate: Check ratios (e.g., Gross Profit Margin, Inventory Turnover).
3. Investigate: If the Gross Profit Margin jumped from 20% to 50% but the business hasn't changed, that is a HUGE red flag! It tells us we need to focus our testing on Sales and Cost of Sales.

Quick Review Box: Analytical procedures at the planning stage help us identify unusual trends so we can plan our testing accordingly.

7. Final Tips for the Exam

When you see a case study about a new client:

• Identify the Risk: Mention the specific account (e.g., "There is a risk that Inventory is overstated...").
• Explain the Reason: "...because the client's products are becoming obsolete due to new technology."
• Link to the Standard: If you can, mention HKSA 315.
• Propose a Response: "We should perform an inventory count and check for slow-moving items."

Encouragement: You've got this! Risk assessment is just about using common sense to figure out where a business is most likely to make a mistake. Keep practicing the past papers to see how these risks repeat across different industries!